]>
Commit | Line | Data |
---|---|---|
b78e3a80 | 1 | .\" Copyright (c) 2006, 2008 by Michael Kerrisk <mtk.manpages@gmail.com> |
0be6f5cc | 2 | .\" |
93015253 | 3 | .\" %%%LICENSE_START(VERBATIM) |
0be6f5cc MK |
4 | .\" Permission is granted to make and distribute verbatim copies of this |
5 | .\" manual provided the copyright notice and this permission notice are | |
6 | .\" preserved on all copies. | |
7 | .\" | |
8 | .\" Permission is granted to copy and distribute modified versions of this | |
9 | .\" manual under the conditions for verbatim copying, provided that the | |
10 | .\" entire resulting derived work is distributed under the terms of a | |
11 | .\" permission notice identical to this one. | |
12 | .\" | |
13 | .\" Since the Linux kernel and libraries are constantly changing, this | |
14 | .\" manual page may be incorrect or out-of-date. The author(s) assume no | |
15 | .\" responsibility for errors or omissions, or for damages resulting from | |
10d76543 MK |
16 | .\" the use of the information contained herein. The author(s) may not |
17 | .\" have taken the same level of care in the production of this manual, | |
18 | .\" which is licensed free of charge, as they might when working | |
19 | .\" professionally. | |
0be6f5cc MK |
20 | .\" |
21 | .\" Formatted or processed versions of this manual, if unaccompanied by | |
22 | .\" the source, must acknowledge the copyright and authors of this work. | |
4b72fb64 | 23 | .\" %%%LICENSE_END |
0be6f5cc | 24 | .\" |
867c9b34 | 25 | .TH CORE 5 2019-10-10 "Linux" "Linux Programmer's Manual" |
0be6f5cc MK |
26 | .SH NAME |
27 | core \- core dump file | |
28 | .SH DESCRIPTION | |
c13182ef | 29 | The default action of certain signals is to cause a process to terminate |
0be6f5cc MK |
30 | and produce a |
31 | .IR "core dump file" , | |
c13182ef | 32 | a disk file containing an image of the process's memory at |
0be6f5cc | 33 | the time of termination. |
78890124 MK |
34 | This image can be used in a debugger (e.g., |
35 | .BR gdb (1)) | |
36 | to inspect the state of the program at the time that it terminated. | |
0be6f5cc MK |
37 | A list of the signals which cause a process to dump core can be found in |
38 | .BR signal (7). | |
2dad4c59 | 39 | .PP |
53cd945e | 40 | A process can set its soft |
0daa9e92 | 41 | .B RLIMIT_CORE |
c13182ef | 42 | resource limit to place an upper limit on the size of the core dump file |
0be6f5cc MK |
43 | that will be produced if it receives a "core dump" signal; see |
44 | .BR getrlimit (2) | |
45 | for details. | |
2dad4c59 | 46 | .PP |
c13182ef | 47 | There are various circumstances in which a core dump file is |
0be6f5cc | 48 | not produced: |
e256d8aa | 49 | .IP * 3 |
67ed0e4b | 50 | The process does not have permission to write the core file. |
91aabea5 | 51 | (By default, the core file is called |
ab0f60c6 MK |
52 | .IR core |
53 | or | |
54 | .IR core.pid , | |
55 | where | |
56 | .I pid | |
57 | is the ID of the process that dumped core, | |
c13182ef | 58 | and is created in the current working directory. |
67ed0e4b | 59 | See below for details on naming.) |
a23d8efa | 60 | Writing the core file fails if the directory in which |
24b74457 | 61 | it is to be created is nonwritable, |
c13182ef | 62 | or if a file with the same name exists and |
67ed0e4b | 63 | is not writable |
c13182ef | 64 | or is not a regular file |
67ed0e4b | 65 | (e.g., it is a directory or a symbolic link). |
e256d8aa | 66 | .IP * |
c13182ef MK |
67 | A (writable, regular) file with the same name as would be used for the |
68 | core dump already exists, but there is more than one hard link to that | |
10cd859a MK |
69 | file. |
70 | .IP * | |
9ee4a2b6 | 71 | The filesystem where the core dump file would be created is full; |
972a8ec7 | 72 | or has run out of inodes; or is mounted read-only; |
9ee4a2b6 | 73 | or the user has reached their quota for the filesystem. |
10cd859a | 74 | .IP * |
c13182ef | 75 | The directory in which the core dump file is to be created does |
67ed0e4b | 76 | not exist. |
0be6f5cc | 77 | .IP * |
78890124 | 78 | The |
0be6f5cc | 79 | .B RLIMIT_CORE |
78890124 | 80 | (core file size) or |
0be6f5cc | 81 | .B RLIMIT_FSIZE |
78890124 MK |
82 | (file size) resource limits for the process are set to zero; see |
83 | .BR getrlimit (2) | |
84 | and the documentation of the shell's | |
85 | .I ulimit | |
86 | command | |
87 | .RI ( limit | |
88 | in | |
89 | .BR csh (1)). | |
0be6f5cc | 90 | .IP * |
c13182ef | 91 | The binary being executed by the process does not have read |
0be6f5cc MK |
92 | permission enabled. |
93 | .IP * | |
94 | The process is executing a set-user-ID (set-group-ID) program | |
c13182ef | 95 | that is owned by a user (group) other than the real user (group) |
60a119dd MK |
96 | ID of the process, |
97 | or the process is executing a program that has file capabilities (see | |
98 | .BR capabilities (7)). | |
0be6f5cc MK |
99 | (However, see the description of the |
100 | .BR prctl (2) | |
101 | .B PR_SET_DUMPABLE | |
102 | operation, and the description of the | |
103 | .I /proc/sys/fs/suid_dumpable | |
14523015 MK |
104 | .\" FIXME . Perhaps relocate discussion of /proc/sys/fs/suid_dumpable |
105 | .\" and PR_SET_DUMPABLE to this page? | |
0be6f5cc MK |
106 | file in |
107 | .BR proc (5).) | |
d298e17f | 108 | .IP * |
6c3d8859 MK |
109 | .I /proc/sys/kernel/core_pattern |
110 | is empty and | |
111 | .I /proc/sys/kernel/core_uses_pid | |
112 | contains the value 0. | |
113 | (These files are described below.) | |
114 | Note that if | |
115 | .I /proc/sys/kernel/core_pattern | |
116 | is empty and | |
117 | .I /proc/sys/kernel/core_uses_pid | |
118 | contains the value 1, | |
119 | core dump files will have names of the form | |
120 | .IR .pid , | |
121 | and such files are hidden unless one uses the | |
122 | .BR ls (1) | |
4818bee5 | 123 | .I \-a |
6c3d8859 MK |
124 | option. |
125 | .IP * | |
d298e17f MK |
126 | (Since Linux 3.7) |
127 | .\" commit 046d662f481830e652ac34cd112249adde16452a | |
128 | The kernel was configured without the | |
129 | .BR CONFIG_COREDUMP | |
130 | option. | |
0ac3f06f MK |
131 | .PP |
132 | In addition, | |
133 | a core dump may exclude part of the address space of the process if the | |
134 | .BR madvise (2) | |
135 | .B MADV_DONTDUMP | |
136 | flag was employed. | |
03c87136 MK |
137 | .PP |
138 | On systems that employ | |
139 | .BR systemd (1) | |
140 | as the | |
141 | .I init | |
142 | framework, core dumps may instead be placed in a location determined by | |
143 | .BR systemd (1). | |
144 | See below for further details. | |
145 | .\" | |
0be6f5cc | 146 | .SS Naming of core dump files |
c13182ef | 147 | By default, a core dump file is named |
0be6f5cc | 148 | .IR core , |
c13182ef | 149 | but the |
0be6f5cc | 150 | .I /proc/sys/kernel/core_pattern |
b78e3a80 | 151 | file (since Linux 2.6 and 2.4.21) |
0be6f5cc MK |
152 | can be set to define a template that is used to name core dump files. |
153 | The template can contain % specifiers which are substituted | |
154 | by the following values when a core file is created: | |
b78e3a80 MK |
155 | .PP |
156 | .RS 4 | |
157 | .PD 0 | |
158 | .TP 4 | |
159 | %% | |
160 | a single % character | |
161 | .TP | |
b9ed1fbb MK |
162 | %c |
163 | core file size soft resource limit of crashing process (since Linux 2.6.24) | |
b78e3a80 | 164 | .TP |
23ed8402 | 165 | %d |
fd9c713b MK |
166 | .\" Added in git commit 12a2b4b2241e318b4f6df31228e4272d2c2968a1 |
167 | dump mode\(emsame as value returned by | |
168 | .BR prctl (2) | |
169 | .B PR_GET_DUMPABLE | |
23ed8402 MF |
170 | (since Linux 3.7) |
171 | .TP | |
b78e3a80 MK |
172 | %e |
173 | executable filename (without path prefix) | |
174 | .TP | |
d7e34031 MK |
175 | %E |
176 | pathname of executable, | |
c46d3d7a BW |
177 | with slashes (\(aq/\(aq) replaced by exclamation marks (\(aq!\(aq) |
178 | (since Linux 3.0). | |
d7e34031 | 179 | .TP |
b9ed1fbb MK |
180 | %g |
181 | (numeric) real GID of dumped process | |
182 | .TP | |
183 | %h | |
184 | hostname (same as \fInodename\fP returned by \fBuname\fP(2)) | |
185 | .TP | |
e04ae86d MK |
186 | %i |
187 | TID of thread that triggered core dump, | |
188 | as seen in the PID namespace in which the thread resides | |
189 | .\" commit b03023ecbdb76c1dec86b41ed80b123c22783220 | |
190 | (since Linux 3.18) | |
191 | .TP | |
192 | %I | |
193 | TID of thread that triggered core dump, as seen in the initial PID namespace | |
194 | .\" commit b03023ecbdb76c1dec86b41ed80b123c22783220 | |
195 | (since Linux 3.18) | |
196 | .TP | |
b9ed1fbb MK |
197 | %p |
198 | PID of dumped process, | |
199 | as seen in the PID namespace in which the process resides | |
200 | .TP | |
7629685c | 201 | %P |
b9ed1fbb MK |
202 | .\" Added in git commit 65aafb1e7484b7434a0c1d4c593191ebe5776a2f |
203 | PID of dumped process, as seen in the initial PID namespace | |
204 | (since Linux 3.12) | |
205 | .TP | |
206 | %s | |
207 | number of signal causing dump | |
208 | .TP | |
209 | %t | |
210 | time of dump, expressed as seconds since the | |
211 | Epoch, 1970-01-01 00:00:00 +0000 (UTC) | |
212 | .TP | |
213 | %u | |
214 | (numeric) real UID of dumped process | |
b78e3a80 MK |
215 | .PD |
216 | .RE | |
217 | .PP | |
c13182ef MK |
218 | A single % at the end of the template is dropped from the |
219 | core filename, as is the combination of a % followed by any | |
0be6f5cc MK |
220 | character other than those listed above. |
221 | All other characters in the template become a literal | |
222 | part of the core filename. | |
f81fb444 | 223 | The template may include \(aq/\(aq characters, which are interpreted |
0be6f5cc | 224 | as delimiters for directory names. |
b78e3a80 MK |
225 | The maximum size of the resulting core filename is 128 bytes (64 bytes |
226 | in kernels before 2.6.19). | |
0be6f5cc MK |
227 | The default value in this file is "core". |
228 | For backward compatibility, if | |
229 | .I /proc/sys/kernel/core_pattern | |
0ea48b19 MK |
230 | does not include |
231 | .I %p | |
232 | and | |
0be6f5cc MK |
233 | .I /proc/sys/kernel/core_uses_pid |
234 | (see below) | |
c7094399 | 235 | is nonzero, then .PID will be appended to the core filename. |
2dad4c59 | 236 | .PP |
5c3ce796 MF |
237 | Paths are interpreted according to the settings that are active for the |
238 | crashing process. | |
4389c7ab MK |
239 | That means the crashing process's mount namespace (see |
240 | .BR mount_namespaces (7)), | |
241 | its current working directory (found via | |
5c3ce796 | 242 | .BR getcwd (2)), |
4389c7ab MK |
243 | and its root directory (see |
244 | .BR chroot (2)). | |
2dad4c59 | 245 | .PP |
10cd859a MK |
246 | Since version 2.4, Linux has also provided |
247 | a more primitive method of controlling | |
0be6f5cc MK |
248 | the name of the core dump file. |
249 | If the | |
250 | .I /proc/sys/kernel/core_uses_pid | |
251 | file contains the value 0, then a core dump file is simply named | |
252 | .IR core . | |
c7094399 | 253 | If this file contains a nonzero value, then the core dump file includes |
0be6f5cc MK |
254 | the process ID in a name of the form |
255 | .IR core.PID . | |
2dad4c59 | 256 | .PP |
4b749a12 | 257 | Since Linux 3.6, |
8c897fc6 KC |
258 | .\" 9520628e8ceb69fa9a4aee6b57f22675d9e1b709 |
259 | if | |
260 | .I /proc/sys/fs/suid_dumpable | |
4b749a12 | 261 | is set to 2 ("suidsafe"), the pattern must be either an absolute pathname |
8c897fc6 | 262 | (starting with a leading \(aq/\(aq character) or a pipe, as defined below. |
b78e3a80 MK |
263 | .SS Piping core dumps to a program |
264 | Since kernel 2.6.19, Linux supports an alternate syntax for the | |
265 | .I /proc/sys/kernel/core_pattern | |
266 | file. | |
267 | If the first character of this file is a pipe symbol (\fB|\fP), | |
aee42577 | 268 | then the remainder of the line is interpreted as the command-line for |
df525461 | 269 | a user-space program (or script) that is to be executed. |
a33adb81 | 270 | .PP |
344bbbd1 MK |
271 | Since kernel 5.3.0, |
272 | .\" commit 315c69261dd3fa12dbc830d4fa00d1fad98d3b03 | |
273 | the pipe template is split on spaces into an argument list | |
274 | .I before | |
275 | the template parameters are expanded. | |
276 | In earlier kernels, the template parameters are expanded first and | |
a33adb81 PW |
277 | the resulting string is split on spaces into an argument list. |
278 | This means that in earlier kernels executable names added by the | |
344bbbd1 MK |
279 | .I %e |
280 | and | |
281 | .I %E | |
282 | template parameters could get split into multiple arguments. | |
a33adb81 PW |
283 | So the core dump handler needs to put the executable names as the last |
284 | argument and ensure it joins all parts of the executable name using spaces. | |
285 | Executable names with multiple spaces in them are not correctly represented | |
344bbbd1 MK |
286 | in earlier kernels, |
287 | meaning that the core dump handler needs to use mechanisms to find | |
a33adb81 PW |
288 | the executable name. |
289 | .PP | |
b78e3a80 MK |
290 | Instead of being written to a disk file, the core dump is given as |
291 | standard input to the program. | |
292 | Note the following points: | |
293 | .IP * 3 | |
294 | The program must be specified using an absolute pathname (or a | |
295 | pathname relative to the root directory, \fI/\fP), | |
296 | and must immediately follow the '|' character. | |
297 | .IP * | |
089527aa MK |
298 | The command-line arguments can include any of |
299 | the % specifiers listed above. | |
300 | For example, to pass the PID of the process that is being dumped, specify | |
301 | .I %p | |
302 | in an argument. | |
5c3ce796 | 303 | .IP * |
b78e3a80 MK |
304 | The process created to run the program runs as user and group |
305 | .IR root . | |
306 | .IP * | |
5c3ce796 MF |
307 | Running as |
308 | .I root | |
309 | does not confer any exceptional security bypasses. | |
4389c7ab | 310 | Namely, LSMs (e.g., SELinux) are still active and may prevent the handler |
5c3ce796 | 311 | from accessing details about the crashed process via |
4389c7ab | 312 | .IR /proc/[pid] . |
5c3ce796 | 313 | .IP * |
089527aa MK |
314 | The program pathname is interpreted with respect to the initial mount namespace |
315 | as it is always executed there. | |
316 | It is not affected by the settings | |
317 | (e.g., root directory, mount namespace, current working directory) | |
318 | of the crashing process. | |
319 | .IP * | |
1c3aae54 MK |
320 | The process runs in the initial namespaces |
321 | (PID, mount, user, and so on) | |
5c3ce796 | 322 | and not in the namespaces of the crashing process. |
4389c7ab | 323 | One can utilize specifiers such as |
5c3ce796 MF |
324 | .I %P |
325 | to find the right | |
4389c7ab | 326 | .I /proc/[pid] |
5c3ce796 MF |
327 | directory and probe/enter the crashing process's namespaces if needed. |
328 | .IP * | |
9d8b2250 MK |
329 | The process starts with its current working directory |
330 | as the root directory. | |
331 | If desired, it is possible change to the working directory of | |
332 | the dumping process by employing the value provided by the | |
333 | .I %P | |
334 | specifier to change to the location of the dumping process via | |
335 | .IR /proc/[pid]/cwd . | |
336 | .IP * | |
b78e3a80 | 337 | Command-line arguments can be supplied to the |
d26a34f0 | 338 | program (since Linux 2.6.24), |
b78e3a80 | 339 | delimited by white space (up to a total line length of 128 bytes). |
97839a76 MK |
340 | .IP * |
341 | The | |
342 | .B RLIMIT_CORE | |
343 | limit is not enforced for core dumps that are piped to a program | |
344 | via this mechanism. | |
d9f2d36a MK |
345 | .\" |
346 | .SS /proc/sys/kernel/core_pipe_limit | |
347 | When collecting core dumps via a pipe to a user-space program, | |
348 | it can be useful for the collecting program to gather data about | |
349 | the crashing process from that process's | |
750653a8 | 350 | .IR /proc/[pid] |
d9f2d36a MK |
351 | directory. |
352 | In order to do this safely, | |
353 | the kernel must wait for the program collecting the core dump to exit, | |
354 | so as not to remove the crashing process's | |
750653a8 | 355 | .IR /proc/[pid] |
d9f2d36a MK |
356 | files prematurely. |
357 | This in turn creates the | |
358 | possibility that a misbehaving collecting program can block | |
359 | the reaping of a crashed process by simply never exiting. | |
2dad4c59 | 360 | .PP |
d9f2d36a MK |
361 | Since Linux 2.6.32, |
362 | .\" commit a293980c2e261bd5b0d2a77340dd04f684caff58 | |
363 | the | |
364 | .I /proc/sys/kernel/core_pipe_limit | |
365 | can be used to defend against this possibility. | |
366 | The value in this file defines how many concurrent crashing | |
367 | processes may be piped to user-space programs in parallel. | |
368 | If this value is exceeded, then those crashing processes above this value | |
369 | are noted in the kernel log and their core dumps are skipped. | |
2dad4c59 | 370 | .PP |
d9f2d36a MK |
371 | A value of 0 in this file is special. |
372 | It indicates that unlimited processes may be captured in parallel, | |
373 | but that no waiting will take place (i.e., the collecting | |
374 | program is not guaranteed access to | |
375 | .IR /proc/<crashing-PID> ). | |
376 | The default value for this file is 0. | |
377 | .\" | |
b78e3a80 MK |
378 | .SS Controlling which mappings are written to the core dump |
379 | Since kernel 2.6.23, the Linux-specific | |
750653a8 | 380 | .IR /proc/[pid]/coredump_filter |
b78e3a80 MK |
381 | file can be used to control which memory segments are written to the |
382 | core dump file in the event that a core dump is performed for the | |
383 | process with the corresponding process ID. | |
2dad4c59 | 384 | .PP |
b78e3a80 MK |
385 | The value in the file is a bit mask of memory mapping types (see |
386 | .BR mmap (2)). | |
387 | If a bit is set in the mask, then memory mappings of the | |
388 | corresponding type are dumped; otherwise they are not dumped. | |
389 | The bits in this file have the following meanings: | |
390 | .PP | |
391 | .PD 0 | |
392 | .RS 4 | |
393 | .TP | |
394 | bit 0 | |
395 | Dump anonymous private mappings. | |
396 | .TP | |
397 | bit 1 | |
398 | Dump anonymous shared mappings. | |
399 | .TP | |
400 | bit 2 | |
401 | Dump file-backed private mappings. | |
402 | .TP | |
403 | bit 3 | |
404 | Dump file-backed shared mappings. | |
405 | .\" file-backed shared mappings of course also update the underlying | |
406 | .\" mapped file. | |
cd3c7b38 MK |
407 | .TP |
408 | bit 4 (since Linux 2.6.24) | |
bb464ec1 | 409 | Dump ELF headers. |
cd3c7b38 MK |
410 | .TP |
411 | bit 5 (since Linux 2.6.28) | |
412 | Dump private huge pages. | |
413 | .TP | |
414 | bit 6 (since Linux 2.6.28) | |
415 | Dump shared huge pages. | |
db02982a RZ |
416 | .TP |
417 | bit 7 (since Linux 4.4) | |
9242ecfe | 418 | .\" commit ab27a8d04b32b6ee8c30c14c4afd1058e8addc82 |
db02982a RZ |
419 | Dump private DAX pages. |
420 | .TP | |
421 | bit 8 (since Linux 4.4) | |
9242ecfe | 422 | .\" commit ab27a8d04b32b6ee8c30c14c4afd1058e8addc82 |
db02982a | 423 | Dump shared DAX pages. |
b78e3a80 MK |
424 | .RE |
425 | .PD | |
426 | .PP | |
cd3c7b38 MK |
427 | By default, the following bits are set: 0, 1, 4 (if the |
428 | .B CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS | |
429 | kernel configuration option is enabled), and 5. | |
7b28cf66 MK |
430 | This default can be modified at boot time using the |
431 | .I coredump_filter | |
432 | boot option. | |
2dad4c59 | 433 | .PP |
cd3c7b38 MK |
434 | The value of this file is displayed in hexadecimal. |
435 | (The default value is thus displayed as 33.) | |
2dad4c59 | 436 | .PP |
a1d5601b | 437 | Memory-mapped I/O pages such as frame buffer are never dumped, and |
0f0713a4 MK |
438 | virtual DSO |
439 | .RB ( vdso (7)) | |
440 | pages are always dumped, regardless of the | |
b78e3a80 MK |
441 | .I coredump_filter |
442 | value. | |
2dad4c59 | 443 | .PP |
b78e3a80 MK |
444 | A child process created via |
445 | .BR fork (2) | |
70d70ddc | 446 | inherits its parent's |
b78e3a80 MK |
447 | .I coredump_filter |
448 | value; | |
a1d5601b | 449 | the |
b78e3a80 MK |
450 | .I coredump_filter |
451 | value is preserved across an | |
452 | .BR execve (2). | |
2dad4c59 | 453 | .PP |
b78e3a80 MK |
454 | It can be useful to set |
455 | .I coredump_filter | |
456 | in the parent shell before running a program, for example: | |
2dad4c59 | 457 | .PP |
b78e3a80 | 458 | .in +4n |
b8302363 | 459 | .EX |
b43a3b30 MK |
460 | .RB "$" " echo 0x7 > /proc/self/coredump_filter" |
461 | .RB "$" " ./some_program" | |
b8302363 | 462 | .EE |
b78e3a80 MK |
463 | .in |
464 | .PP | |
33a0ccb2 | 465 | This file is provided only if the kernel was built with the |
e242920a MK |
466 | .B CONFIG_ELF_CORE |
467 | configuration option. | |
03c87136 MK |
468 | .\" |
469 | .SS Core dumps and systemd | |
470 | On systems using the | |
471 | .BR systemd (1) | |
472 | .I init | |
473 | framework, core dumps may be placed in a location determined by | |
474 | .BR systemd (1). | |
475 | To do this, | |
476 | .BR systemd (1) | |
477 | employs the | |
478 | .I core_pattern | |
dc4674ac | 479 | feature that allows piping core dumps to a program. |
03c87136 | 480 | One can verify this by checking whether core dumps are being piped to the |
4818bee5 | 481 | .BR systemd\-coredump (8) |
03c87136 MK |
482 | program: |
483 | .PP | |
484 | .in +4n | |
485 | .EX | |
486 | $ \fBcat /proc/sys/kernel/core_pattern\fP | |
4818bee5 | 487 | |/usr/lib/systemd/systemd\-coredump %P %u %g %s %t %c %e |
03c87136 MK |
488 | .EE |
489 | .in | |
490 | .PP | |
491 | In this case, core dumps will be placed in the location configured for | |
4818bee5 | 492 | .BR systemd\-coredump (8), |
03c87136 MK |
493 | typically as |
494 | .BR lz4 (1) | |
495 | compressed files in the directory | |
496 | .IR /var/lib/systemd/coredump/ . | |
497 | One can list the core dumps that have been recorded by | |
4818bee5 | 498 | .BR systemd\-coredump (8) |
03c87136 MK |
499 | using |
500 | .BR coredumpctl (1): | |
501 | .PP | |
6e3b05fe | 502 | .in +2n |
03c87136 MK |
503 | .EX |
504 | $ \fBcoredumpctl list | tail -5\fP | |
505 | Wed 2017-10-11 22:25:30 CEST 2748 1000 1000 3 present /usr/bin/sleep | |
506 | Thu 2017-10-12 06:29:10 CEST 2716 1000 1000 3 present /usr/bin/sleep | |
507 | Thu 2017-10-12 06:30:50 CEST 2767 1000 1000 3 present /usr/bin/sleep | |
508 | Thu 2017-10-12 06:37:40 CEST 2918 1000 1000 3 present /usr/bin/cat | |
509 | Thu 2017-10-12 08:13:07 CEST 2955 1000 1000 3 present /usr/bin/cat | |
510 | .EE | |
511 | .in | |
512 | .PP | |
513 | The information shown for each core dump includes the date and time | |
514 | of the dump, the PID, UID, and GID of the dumping process, | |
515 | the signal number that caused the core dump, | |
516 | and the pathname of the executable that was being run by the dumped process. | |
517 | Various options to | |
518 | .BR coredumpctl (1) | |
519 | allow a specified coredump file to be pulled from the | |
520 | .BR systemd (1) | |
521 | location into a specified file. | |
522 | For example, to extract the core dump for PID 2955 shown above to a file named | |
523 | .IR core | |
dc4674ac | 524 | in the current directory, one could use: |
03c87136 MK |
525 | .PP |
526 | .in +4n | |
527 | .EX | |
4818bee5 | 528 | $ \fBcoredumpctl dump 2955 \-o core\fP |
03c87136 MK |
529 | .EE |
530 | .in | |
531 | .PP | |
532 | For more extensive details, see the | |
533 | .BR coredumpctl (1) | |
534 | manual page. | |
535 | .PP | |
536 | To disable the | |
537 | .BR systemd (1) | |
538 | mechanism that archives core dumps, restoring to something more like | |
539 | traditional Linux behavior, one can set an override for the | |
540 | .BR systemd (1) | |
541 | mechanism, using something like: | |
542 | .PP | |
543 | .in +2n | |
544 | .EX | |
4818bee5 JW |
545 | # echo "kernel.core_pattern=core.%p" > /etc/sysctl.d/50\-coredump.conf |
546 | # /lib/systemd/systemd\-sysctl | |
03c87136 MK |
547 | .EE |
548 | .in | |
549 | .PP | |
550 | .\" | |
0be6f5cc | 551 | .SH NOTES |
c13182ef | 552 | The |
0be6f5cc MK |
553 | .BR gdb (1) |
554 | .I gcore | |
555 | command can be used to obtain a core dump of a running process. | |
2dad4c59 | 556 | .PP |
173e4d50 MK |
557 | In Linux versions up to and including 2.6.27, |
558 | .\" Changed with commit 6409324b385f3f63a03645b4422e3be67348d922 | |
559 | if a multithreaded process (or, more precisely, a process that | |
5ddfb8c7 MK |
560 | shares its memory with another process by being created with the |
561 | .B CLONE_VM | |
562 | flag of | |
563 | .BR clone (2)) | |
c13182ef | 564 | dumps core, then the process ID is always appended to the core filename, |
d216b211 | 565 | unless the process ID was already included elsewhere in the |
0ea48b19 MK |
566 | filename via a |
567 | .I %p | |
568 | specification in | |
5ddfb8c7 | 569 | .IR /proc/sys/kernel/core_pattern . |
173e4d50 MK |
570 | (This is primarily useful when employing the obsolete |
571 | LinuxThreads implementation, | |
b8424e6a | 572 | where each thread of a process has a different PID.) |
4b47fc34 MK |
573 | .\" Always including the PID in the name of the core file made |
574 | .\" sense for LinuxThreads, where each thread had a unique PID, | |
905e99f2 | 575 | .\" but doesn't seem to serve any purpose with NPTL, where all the |
c13182ef | 576 | .\" threads in a process share the same PID (as POSIX.1 requires). |
d9bfdb9c | 577 | .\" Probably the behavior is maintained so that applications using |
c13182ef | 578 | .\" LinuxThreads continue appending the PID (the kernel has no easy |
7fac88a9 | 579 | .\" way of telling which threading implementation the user-space |
d216b211 | 580 | .\" application is using). -- mtk, April 2006 |
b78e3a80 MK |
581 | .SH EXAMPLE |
582 | The program below can be used to demonstrate the use of the | |
a1d5601b | 583 | pipe syntax in the |
b78e3a80 MK |
584 | .I /proc/sys/kernel/core_pattern |
585 | file. | |
586 | The following shell session demonstrates the use of this program | |
587 | (compiled to create an executable named | |
588 | .IR core_pattern_pipe_test ): | |
589 | .PP | |
590 | .in +4n | |
b8302363 | 591 | .EX |
b43a3b30 MK |
592 | .RB "$" " cc \-o core_pattern_pipe_test core_pattern_pipe_test.c" |
593 | .RB "$" " su" | |
b78e3a80 | 594 | Password: |
e9b77925 | 595 | .RB "#" " echo \(dq|$PWD/core_pattern_pipe_test %p \ |
31a6818e | 596 | UID=%u GID=%g sig=%s\(dq > \e" |
b43a3b30 MK |
597 | .B " /proc/sys/kernel/core_pattern" |
598 | .RB "#" " exit" | |
599 | .RB "$" " sleep 100" | |
31a6818e | 600 | .BR "^\e" " # type control-backslash" |
b78e3a80 | 601 | Quit (core dumped) |
b43a3b30 | 602 | .RB "$" " cat core.info" |
b78e3a80 MK |
603 | argc=5 |
604 | argc[0]=</home/mtk/core_pattern_pipe_test> | |
605 | argc[1]=<20575> | |
606 | argc[2]=<UID=1000> | |
607 | argc[3]=<GID=100> | |
608 | argc[4]=<sig=3> | |
609 | Total bytes in core dump: 282624 | |
b8302363 | 610 | .EE |
b78e3a80 | 611 | .in |
9c330504 | 612 | .SS Program source |
d84d0300 | 613 | \& |
e7d0bb47 | 614 | .EX |
b78e3a80 MK |
615 | /* core_pattern_pipe_test.c */ |
616 | ||
617 | #define _GNU_SOURCE | |
618 | #include <sys/stat.h> | |
619 | #include <fcntl.h> | |
620 | #include <limits.h> | |
621 | #include <stdio.h> | |
622 | #include <stdlib.h> | |
623 | #include <unistd.h> | |
624 | ||
625 | #define BUF_SIZE 1024 | |
626 | ||
627 | int | |
628 | main(int argc, char *argv[]) | |
629 | { | |
630 | int tot, j; | |
631 | ssize_t nread; | |
632 | char buf[BUF_SIZE]; | |
633 | FILE *fp; | |
634 | char cwd[PATH_MAX]; | |
635 | ||
a1d5601b | 636 | /* Change our current working directory to that of the |
b78e3a80 MK |
637 | crashing process */ |
638 | ||
639 | snprintf(cwd, PATH_MAX, "/proc/%s/cwd", argv[1]); | |
640 | chdir(cwd); | |
641 | ||
642 | /* Write output to file "core.info" in that directory */ | |
643 | ||
644 | fp = fopen("core.info", "w+"); | |
645 | if (fp == NULL) | |
646 | exit(EXIT_FAILURE); | |
647 | ||
648 | /* Display command\-line arguments given to core_pattern | |
649 | pipe program */ | |
650 | ||
d1a71985 | 651 | fprintf(fp, "argc=%d\en", argc); |
b78e3a80 | 652 | for (j = 0; j < argc; j++) |
d1a71985 | 653 | fprintf(fp, "argc[%d]=<%s>\en", j, argv[j]); |
b78e3a80 MK |
654 | |
655 | /* Count bytes in standard input (the core dump) */ | |
656 | ||
657 | tot = 0; | |
a1d5601b | 658 | while ((nread = read(STDIN_FILENO, buf, BUF_SIZE)) > 0) |
b78e3a80 | 659 | tot += nread; |
d1a71985 | 660 | fprintf(fp, "Total bytes in core dump: %d\en", tot); |
b78e3a80 | 661 | |
aaec25cb | 662 | fclose(fp); |
b78e3a80 MK |
663 | exit(EXIT_SUCCESS); |
664 | } | |
e7d0bb47 | 665 | .EE |
0be6f5cc | 666 | .SH SEE ALSO |
a2aac039 | 667 | .BR bash (1), |
cb1b1630 | 668 | .BR coredumpctl (1), |
0be6f5cc MK |
669 | .BR gdb (1), |
670 | .BR getrlimit (2), | |
a8b32c31 | 671 | .BR mmap (2), |
0be6f5cc MK |
672 | .BR prctl (2), |
673 | .BR sigaction (2), | |
674 | .BR elf (5), | |
675 | .BR proc (5), | |
b8424e6a | 676 | .BR pthreads (7), |
a971f652 | 677 | .BR signal (7), |
4818bee5 | 678 | .BR systemd\-coredump (8) |